Debian 10 DLA-3176-1 Moderate: Clickhouse Code Execution Risk

debian lts

November 4, 2022

Several security vulnerabilities were discovered in clickhouse, a column-oriented database system

Topics Covered

security advisory moderate code execution Debian memory leak database Clickhouse

Summary

The vulnerabilities require authentication, but can be triggered by any user
with read permissions. This means the attacker must perform reconnaissance on
the specific ClickHouse server target to obtain valid credentials. Any set of
credentials would do, since even a user with the lowest privileges can trigger
all of the vulnerabilities. By triggering the vulnerabilities, an attacker can
crash the ClickHouse server, leak memory contents or even cause remote code
execution.

CVE-2021-42387:
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when
parsing a malicious query. As part of the LZ4::decompressImpl() loop,
a 16-bit unsigned user-supplied value ('offset') is read from the
compressed data. The offset is later used in the length of a copy
operation, without checking the upper bounds of the source of the copy
operation.

CVE-2021-42388:
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when
parsing a malicious query. As part of the LZ4::decompressImpl() loop,